ci(deps): bump the github-actions-minor-patch group across 1 directory with 2 updates#86
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
…y with 2 updates Bumps the github-actions-minor-patch group with 2 updates in the / directory: [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) and [actions/setup-python](https://github.com/actions/setup-python). Updates `docker/setup-buildx-action` from 4.0.0 to 4.1.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@4d04d5d...d7f5e7f) Updates `actions/setup-python` from 6.2.0 to 6.3.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a309ff8...ece7cb0) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-minor-patch - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
lelia
added a commit
that referenced
this pull request
Jul 21, 2026
- requests >=2.31.0 -> >=2.33.0 (#87); targeted 'uv lock --upgrade-package requests' resolves 2.34.2 (newer than Dependabot's 2.33.0) and pulls light-s3-client 0.0.40 -- the only two packages Dependabot's own PR touched. - actions/setup-python 6.2.0 -> 6.3.0 in python-tests.yml (#86, SHA verified against the v6.3.0 tag). The group's setup-buildx 4.1.0 bump is already in this branch. - docker/metadata-action 6.1.0 (#81) is already applied here (identical SHA) -- #81 is fully superseded, no code change. All three PRs to be closed manually as superseded by #78. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Contributor
|
Superseded by #78, which bundles this update along with the other open Dependabot PRs (verified together, targeted |
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/github_actions/github-actions-minor-patch-95b10c581c
branch
July 21, 2026 22:46
lelia
added a commit
that referenced
this pull request
Jul 22, 2026
…kflows (#78) * chore(deps): bundle dependency updates + harden supply-chain review Bundles 8 open Dependabot PRs into one verified change and hardens the Dependabot config + dependency-review workflows, mirroring the work in socket-sdk-python#84 and socket-python-cli#207/#217. Adds a supply-chain watch for the four core OSS tools Dependabot cannot cleanly track. - uv.lock: idna 3.10->3.18 (CVE-2026-45409), pygments 2.19.2->2.20.0, pytest 8.4.2->9.0.3, urllib3 2.6.3->2.7.0 - _docker-pipeline.yml: bump 4 docker/* actions (setup-buildx, login, metadata, build-push) - dependabot.yml: add uv ecosystem, group every ecosystem into minor/patch + major bundles, scan composite actions - dependency-review.yml (was dependabot-review.yml): runs on every PR; free/enterprise sfw split; report artifacts; app_tests docker smoke - core-tool-watch.yml + scripts/check_core_tools.py: discover latest versions of opengrep/trufflehog/trivy/socketdev and score them through the Socket API (socketdev SDK purl.post); drift issue + report artifact - python-tests.yml: uv.lock drift guard Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(ci): drop socket-firewall environment gate, add required coverage gate Mirroring the Python CLI/SDK used `environment: socket-firewall` to scope the SFW token, but that environment can carry a required-reviewers approval gate. Because the enterprise SFW check can't be a required status check (it would block Dependabot/fork PRs that only run the free edition), maintainers could merge without approving the deployment -- the meaningful check silently never ran, and approvers could rubber-stamp their own PRs. On the scheduled core-tool-watch job an approval gate would hang the cron run outright. - Remove `environment:` from python-sfw-smoke-enterprise and core-tool-watch; use a plain repo/org SOCKET_SFW_API_TOKEN (zizmor secrets-outside-env is already disabled here, so no lint cost). Job split still isolates the token to the enterprise job only. - Add always-on `dependency-review-gate` job: pass when no python deps changed, else require the free (Dependabot/fork) or enterprise (maintainer) smoke job to have succeeded. Mark THIS as the single required status check -- safe on every PR, no manual gate, no bypass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(ci): scope SFW token via environment (no approval rule), harden gate Adopt the socket-python-cli#224 pattern uniformly. The environment was never the problem -- the required-reviewers approval RULE on it was. Keep the environment for secret scoping; forbid the rule. - Restore `environment: socket-firewall` on python-sfw-smoke-enterprise and the core-tool-watch analyze job so SOCKET_SFW_API_TOKEN is scoped to those jobs. Header documents that the environment must have NO reviewers rule, with the gh api command to enforce it (reviewers: null). - dependency-review-gate (Pattern 2 aggregator): now also needs docker-smoke-app-tests; fails on any failure/cancelled result (success and skipped pass) AND requires the trust-appropriate SFW edition to have succeeded when Python deps changed. Runs if: always() so the required context is always created -- no Pattern 1 bypass twin needed. Must land on main before being added to branch protection. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * fix(ci): degrade SFW enterprise to free when token absent; upload JSON report Live CI exposed two things on the now-enabled Actions: - socketdev/action firewall-enterprise HARD-ERRORS on an empty token (no silent fallback), so a trusted dep PR opened before the SOCKET_SFW_API_TOKEN secret exists fails and the required gate blocks merge. setup-sfw now resolves the effective mode and falls back to firewall-free when enterprise is requested without a token -- still a real supply-chain check, ships green today, auto-upgrades to enterprise the moment the secret is added. Token is read via env, never interpolated into the script. - socketdev/action writes a structured report to $SFW_JSON_REPORT_PATH; both smoke jobs now capture it and upload it alongside the tee'd log. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * feat(core-tool-watch): add Semgrep upstream proxy for OpenGrep Socket scoring OpenGrep ships as a GitHub-release binary that Socket has no data for under its pkg:github coordinate, so the watcher reported 'no data' for it. OpenGrep is a hard fork of Semgrep, so fall back to scoring the upstream Semgrep lineage (pkg:pypi/semgrep) as a project-health proxy. The proxy is report-only and never build-failing: it does not analyze OpenGrep's own release artifacts, so a Semgrep alert must not block an OpenGrep build. The pinned/latest verdicts show the proxy result labeled '(via semgrep upstream proxy)' when the primary coordinate has no data, and the JSON report records it under a separate 'proxy' key. The npm 'opengrep' package is a single-version squat (not the official distribution) and is deliberately not used as a coordinate. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * chore(deps): bundle 3 newly-filed Dependabot PRs (#81, #86, #87) - requests >=2.31.0 -> >=2.33.0 (#87); targeted 'uv lock --upgrade-package requests' resolves 2.34.2 (newer than Dependabot's 2.33.0) and pulls light-s3-client 0.0.40 -- the only two packages Dependabot's own PR touched. - actions/setup-python 6.2.0 -> 6.3.0 in python-tests.yml (#86, SHA verified against the v6.3.0 tag). The group's setup-buildx 4.1.0 bump is already in this branch. - docker/metadata-action 6.1.0 (#81) is already applied here (identical SHA) -- #81 is fully superseded, no code change. All three PRs to be closed manually as superseded by #78. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * fix(core-tool-watch): address Cursor Bugbot findings on #78 Five hardening fixes flagged by Bugbot: 1. Critical alerts now fail-on-malware (was malware-only). Track any_critical separately and exit non-zero on malware OR critical, matching the documented intent; add a 'critical' GitHub output. 2. Pins are read from BOTH Dockerfiles. app_tests/Dockerfile pins the same core tools (trufflehog/trivy/opengrep) independently; the reader only saw the root Dockerfile, so a divergent app_tests bump went unscored. Tool.pinned is now a list of every distinct pinned version, all of which are scored. 3. Watch mode no longer fails on latest. Only PINNED (in-use) versions are fail-worthy; the discovered latest is scored for drift reporting only, so a scheduled watch can't go red on an upstream release we haven't adopted. 4. dependency-review-gate fails closed when inspect fails. A failed inspect left DEPS_CHANGED/IS_TRUSTED empty, so the coverage rules silently passed and a PR with dep changes could merge with no Socket Firewall run. Added Rule 0. 5. Socket API errors fail closed in build mode. A swallowed analyze_purls exception let --fail-on-malware exit 0 with pinned versions unverified; now a scoring error (token present) fails the run. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * fix(ci): address 2 more Bugbot findings on #78 1. Drift issue never opened (High). gh issue list --jq '.[0].number' prints the literal string 'null' when no open core-tool-drift issue exists; 'null' is non-empty in bash, so the first scheduled drift run would call 'gh issue edit null' instead of creating the issue. Use '// empty' so an absent issue yields an empty string and the create branch runs. 2. Tests ignored the lockfile (Medium). python-tests installed deps via 'pip install -e .[dev]' (a fresh resolution) while only asserting the lock separately, so tests could run against different versions than uv.lock. Switch to 'uv sync --locked --extra dev' + 'uv run --no-sync pytest' so tests run against exactly the locked set. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * fix(ci): restore bare LICENSE to unblock CI (mirrors #88) Temporary: pull #88's fix into this branch so CI's merge-with-main ref builds. PR #79 renamed the license to LICENSE.md and deleted the empty LICENSE, but pyproject.toml and the Dockerfile still reference LICENSE, so hatchling and the Docker build fail against current main. This restores the PolyForm content into bare LICENSE (rename LICENSE.md -> LICENSE) and drops the now-moot !LICENSE.md .gitignore exception. Revert this commit and pull latest main once #88 lands there (main will then carry the identical fix). Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * fix(core-tool-watch): per-event concurrency group + document Dependabot secret gap - Include github.event_name in the concurrency group so a merge to main can't cancel the in-flight weekly watch run (or vice versa). - Document that Dependabot-triggered pull_request runs never receive the environment-scoped SOCKET_SFW_API_TOKEN (only Dependabot secrets), so build-mode scoring silently degrades to drift-only there; note the 'gh secret set --app dependabot' mirror needed for pre-merge coverage. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(deps-review): route Dependabot through sfw-enterprise; isolate core-tool-watch scan env Dependabot-triggered runs can read a *Dependabot-store* secret (set via 'gh secret set SOCKET_SFW_API_TOKEN --app dependabot'), so the free-tier routing for Dependabot -- a workaround for the assumption that its runs could never hold a token -- is gone: - dependency-review.yml: trusted == any in-repo (non-fork) PR, now including Dependabot. Its dep bumps get full org-policy (enterprise) enforcement; forks stay on the anonymous free edition. setup-sfw's existing empty-token fallback covers the window until the Dependabot secret mirror exists. - core-tool-watch.yml: sync the scan's Python env from the DEFAULT BRANCH lockfile (second checkout at .scan-env) so the token-holding step never imports packages bumped by the PR under review -- it only reads the PR's pins. Makes the Dependabot token mirror safe here too. - dependency-review.yml: import smokes use 'uv run --no-sync' so the post-firewall step can't re-sync outside sfw (Bugbot finding). - check_core_tools.py: docstring/help now honestly describe the strict fail thresholds (curated malware-class list + high/critical), which are intentional (Bugbot finding). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(core-tool-watch): sync scan env with --no-install-project The scan env checkout of main fails to build the socket-basics package editable while main carries the LICENSE.md rename breakage (#79, fix pending in #88). The scan only imports the dependencies (socketdev SDK), never socket_basics itself, so skip installing the project entirely -- also insulates this guard from any future main-side packaging breakage. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(core-tool-watch): org-scoped purl endpoint + fail closed on empty API result Two related hardenings from external review of purl.post() usage: - Pass org_slug (resolved via client.org.get) when the installed SDK supports it: socketdev >= 3.1 (socket-sdk-python#76) deprecates the legacy POST /v0/purl in favor of POST /v0/orgs/{slug}/purl, and a future major may drop the legacy route. The pinned 3.0.29 predates the parameter, so it is signature-gated -- activates automatically when the scan env's lockfile bumps the SDK. - Raise on an empty purl.post result: the SDK swallows ANY non-200 (expired token, dropped endpoint, outage) into [], which previously flowed through as 'no data' verdicts and exit 0 -- fail-open. Every run scores coordinates Socket definitely has data for, so empty is an API failure; raising routes it into the existing scoring_error fail-closed path under --fail-on-malware. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(core-tool-watch): resolve org slug only when unambiguous Match socket-python-cli's get_org_id_slug() semantics: pass org_slug to purl.post only when the token maps to exactly one org; multi-org tokens fall back to the legacy endpoint with a notice rather than guessing and scoring under the wrong org's policies. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(core-tool-watch): fail closed on unverified pinned coordinates Bugbot: a non-empty but incomplete Socket batch (or a pinned coordinate that never matches a returned analysis row) previously passed as 'no data' with exit 0 -- the guard could green-light a build without verifying every pin it exists to gate. Tools now declare socket_coverage (default True); with a token and a successful scoring pass, any covered pinned coordinate missing from the results is collected as unverified and fails a --fail-on-malware run, listing the exact coordinates. OpenGrep sets socket_coverage=False: its pkg:github coordinate is the documented no-data case with the report-only semgrep proxy, and must not perma-fail the guard. The unverified list is also surfaced in the JSON report. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions-minor-patch group with 2 updates in the / directory: docker/setup-buildx-action and actions/setup-python.
Updates
docker/setup-buildx-actionfrom 4.0.0 to 4.1.0Release notes
Sourced from docker/setup-buildx-action's releases.
Commits
d7f5e7fMerge pull request #489 from docker/dependabot/npm_and_yarn/docker/actions-to...92bc5c9chore: update generated contentda11e35build(deps): bump@docker/actions-toolkitfrom 0.79.0 to 0.90.0f021e16Merge pull request #492 from docker/dependabot/npm_and_yarn/undici-6.24.1b5af94fchore: update generated content16ad977build(deps): bump undici from 6.23.0 to 6.25.0d7a12d7Merge pull request #495 from docker/dependabot/npm_and_yarn/glob-10.5.028ff27dbuild(deps): bump glob from 10.3.12 to 13.0.6daf436bMerge pull request #496 from docker/dependabot/npm_and_yarn/fast-xml-parser-5...9725348chore: update generated contentUpdates
actions/setup-pythonfrom 6.2.0 to 6.3.0Release notes
Sourced from actions/setup-python's releases.
Commits
ece7cb0Fix pip cache error handling on Windows. (#1040)1d18d7aUpdate advanced-usage.md (#811)d2b357aUpdate dependency versions and test workflow configuration (#1322)8f639b1Merge pull request #1324 from jasongin/update-actions-cache-5.1.06731c2bResolve high-severity audit issues0cb1a84Add RHEL support and include Linux distro in cache keys (#1323)dc6eab6Update dist6f4b74bStrict equalityfa8bde1Bump@actions/cacheto 5.1.0, log cache write deniedc8813baUpgrade@actionsdependencies and update licenses (#1303)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions